W32Nimda_E

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Security
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - Security Update 823559 I have downloaded this update at least a dozen times this year, but when Windows 98 SE scans for updates this item always shows. My download history indicates each download was successful. How do I delete all the previous downloads, and how do I ensure that this download can be done correctly? Thank you Tag: W32Nimda_E Tag: 41923
  - 2
    - SUS -- is it really this lacking? Hi ther I've deployed SUS. That bit's all fine and working well (I think) The problem is, I only think it is. As all the documentation says, I need to verify that the patch management is happening on all my machines I'm fully aware of tools like MBSA, MBSACLI, hfnetchk, etc. They all have one problem. They are built as network scanners and a machine that is turned off at the time you run the scan will not be scanned I would like to be able to run MBSA on each machine at startup or when a user logs in. This would ensure that machines are scanned regularly. If I relied on regular scanning from my workstation, I would not scan any machine that boots up only in the evening. Also, laptops that come on site for only a few hours a month can be scanned as well. In this scenario, the very machines that present the greatest risk to a business are the ones that don't get scanned Back to running MBSACLI on bootup or login -- I can't! MBSA only runs with administrative rights! What's more, if I use a computer startup script in group policy, the process runs under the system account and can't attach to the network to get the mssecure.xml file or to connect to SUS Am I the only one who thinks this is a severe shortcoming? Bigger environments can afford SMS (both the product cost and the skills required to administer it). In a 250-user environment this just isn't going to happen. Tag: W32Nimda_E Tag: 41921
  - 3
    - why they keep coming back? Hi, I use ad-aware 6 and also like to use the online scanner Pestscan simultaneously-They dont always find the same spyware but I'd guess they do OK. Here's is my concern. I got online and scanned with PS and then AAW. Cleaned out all they detected. Then I went to this NGroup & read some>then to see updates at windows>then to check my mail at yahoo>then did a housecall virus scan (pc was virus free>I did not go to anymore websites. So why is it when I scanned again with PS, it found "counterhit click (or something like that)& 207{1} txt in my cookies in the "c" drive.MY QUESTION: does this spyware just creep in because it already knows my IP address and whe Im online, it takes advantage of this- I'd like to understand more about this. please help Tag: W32Nimda_E Tag: 41917
  - 4
    - Blocking local users from using Messenger Service Heres the scenario: Recently we have had a group of users using Messenger Service to distribute messeges etc. I have since disabled the service through control pannel --> services. How do I prevent them from simply going back into control pannel --> services and re-enabling the service? The trouble is that they need to have the profile set as power users so that it can run certain programs. All I want to do is disable their access to the contol pannel, but keep them as power users. Can this be done? If so... how? Many thanks, Tag: W32Nimda_E Tag: 41915
  - 5
    - passport .net Installing a new computer for my 11 year old son, set him up for Passport .net before reading the kids passport post completely. Have spent the last hour looking for how to uninstall passport .net and can't find any instructions ANYWHERE. I want this thing off my son's machine because it will tell people how old he is and where he lives, or so it says. If anyone can tell me how to do it I would be most grateful. Imagine Microsoft setting up this service without an obvious uninstall-- it is shameful. Tag: W32Nimda_E Tag: 41913
  - 6
    - My browser is being hijacked Every time I open IE Explorer, I get redirected to zestyfind. I can't get rid of it. I've used spyware removal, but it comes back up. I've tried deleting any files associated with it as well, but it still comes up. Every time I do a search, or load a favorite, I am redirected to a place called UCSearch. I am very frustrated, as I have tried everything I know to get this off my system, but it keeps coming back. I also installed the latest IE service\security pack, to no avail. If anyone has any ideas, please let me know. Tag: W32Nimda_E Tag: 41906
  - 7
    - I cant open my email count any more:( Dear Sir: I found that I cant use my email count yesterday, I tried several time but I just cant use my passwords log in as before. I do nto know why, and I didnt change my password, and I never tell others about my password as well. and I do not think others can see my passaword too because I m only myself in the home. I hope you can tell me what happened on my count and better can let me use the count again. Can you reply to me in my yahoo count? it is sweetlover1314a@yahoo.com thanks Eve Tag: W32Nimda_E Tag: 41901
  - 8
    - patching 4.0 Has anyone had trouble applying patches to NT 4.0 with sp 6a applied ?? Tag: W32Nimda_E Tag: 41897
  - 9
    - web camera in the MSN massenger i have a web cam that was working perfectly well, i could always see peaple in the messanger and they could see me, until the previous week, something went wrong, i dont realy know what, but maybe it's because i upgraded my massenger to version 6.1 , although my friends dont have a problem with it. anyway, now i can only see myself in the program of the camera but in the msn it doesnt work please HELP me thank you, Liron. Tag: W32Nimda_E Tag: 41894
  - 10
    - Alexa Data Miner Ad-Aware scan picks up Alexa as a Register Key and "Windows" as a Registry value. Should I Quarantine or Remove either or both of these? I seem to remember reading someplace that Microsoft (or Windows) included Alexa intentionally. My last scan picked up 54 new Suspect Files in Temp. - is that normal or unusual? I find the Ad-Aware User Guide to be pretty heavy. Just leaving it on Default, but the scan takes quite awhile, deep scanning all of my hard drive. Advice?? Tag: W32Nimda_E Tag: 41893
  - 11
    - securty update for Windose ME Why does critical update EXPLORER 6 SPI KB824145 LOADED 20 TIMES IN MY HISTORY FILE OF FILES DOWN LOADED Tag: W32Nimda_E Tag: 41892
  - 12
    - A "secure" Guest account for ISA server Humor me on this, please. I know it's a stupid question. Given: a)the Guest account has been renamed b)the Guest account's password is blank c)the only right the Guest account needs is "access this computer from the network", but it doesn't need file or print access d)this is a Windows 2000 member server in an NT4 domain (AD to be implemented next year) How would you go about "securing" the server? I'm thinking explicit denies on various registry keys and system files. The problem is this: management wants to deploy an interior anonymous proxy server, but they want to know who uses it to go where. Probably 75% of the users will be from trusted domains. It is up to the untrusted domains as to how they will prevent "their" users from using "our" proxy (yes, it's a political nightmare). The only way around this that I can see (without an ISA everyone/everywhere anonymous rule, which is enforced before authentication) is a Guest account with a blank password. This worked well on Proxy 2.0 because it would log PROXYSERVER\UNTRUSTEDDOMAINUSER whenever someone used the Guest account. ISA unfortunately logs ISASERVER\GUESTACCOUNT, but I can live with that. The ISA server sits behind a PIX so it's not directly exposed to the Internet. It will support Web Proxy and Firewall clients, but not SecureNAT clients. REGARDLESS OF THE UNDENIABLE FACT THAT ENABLING "GUEST" WITH A BLANK PASSWORD IS A BAD IDEA, how would you go about locking it down as much as possible but retaining ISA functionality? Tag: W32Nimda_E Tag: 41891
  - 13
    - user name and password I am using XP Home and internet explora 6. On one website that I need to log into, it will not accept my user name and password. However if I use my laptop which is windows 2000 it works and allows me to log in. How can I adjust XP to allow log in. On XP I can log into all other sites. What is the solution Tag: W32Nimda_E Tag: 41890
  - 14
    - IE Problem The following link: http://dino-soft.org/security/newurlhole.html appears in the alt.comp.anti-virus NG (DANGEROUS new internet security hole Sugien). Example 5 was enough to get me to change browsers. Now using Opera. There's a brew-hah-hah going on about not crediting the origin of this proof-of-concept (POC) test, but that should not detract from the seriousness of this security hole. For the average IE user, it is not enough to practice so called safe-hex in order to prevent ramifications of this security hole from happening. Although reports of the true link showing up for a short time in the status bar, only Opera had you go through a pop up window showing the true server, which you had to OK before being redirected. I'm not happy about changing browsers as I don't like going through learning curves, but not being able to trust a URL is simply unacceptable. -- ~~~~~~~~~~~~~~~~~ Dave McAuliffe Central Mass. USA To Reply - Replace: mailinator.com With: email.com ~~~~~~~~~~~~~~~~~ Tag: W32Nimda_E Tag: 41883
  - 15
    - Outook Express Password I have forgotten my password in outlook express - can anyone help? Tag: W32Nimda_E Tag: 41876
  - 16
    - PING: PA Bear This is a multi-part message in MIME format. ------=_NextPart_000_0012_01C3C1E3.31E00DD0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable HAPPY BIRTHDAY !!! =20 --=20 siljaline=20 MS - MVP Windows IE/OE ______________________ (Reply to group, as return address is invalid - that we may all benefit) ------=_NextPart_000_0012_01C3C1E3.31E00DD0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=3DContent-Type content=3D"text/html; = charset=3Diso-8859-1"> <META content=3D"MSHTML 6.00.2800.1276" name=3DGENERATOR> <STYLE></STYLE> </HEAD> <BODY> <DIV><FONT face=3DArial size=3D2></FONT><FONT face=3D"Comic Sans MS" = size=3D5><FONT=20 color=3D#ff0000>HAPPY BIRTHDAY !!!</FONT>   </FONT></DIV> <DIV><FONT face=3DArial size=3D2></FONT> </DIV> <DIV> </DIV> <DIV><BR><FONT face=3DArial size=3D2>-- <BR>siljaline </FONT></DIV> <DIV><FONT face=3DArial size=3D2></FONT> </DIV> <DIV><FONT face=3DArial size=3D2>MS - MVP Windows=20 IE/OE<BR>______________________</FONT></DIV> <DIV><FONT face=3DArial size=3D2></FONT> </DIV> <DIV><FONT face=3DArial size=3D2>(Reply to group, as return = address<BR>is invalid -=20 that we may all benefit)</FONT></DIV> <DIV><FONT face=3DArial size=3D2></FONT> </DIV> <DIV><FONT face=3DArial size=3D2></FONT> </DIV></BODY></HTML> ------=_NextPart_000_0012_01C3C1E3.31E00DD0-- Tag: W32Nimda_E Tag: 41875
  - 17
    - a file i cant delete i downloaded a file that i cannot delete, which i am worried about. I scanned it with norton anti virus wnad it says it has no infection but i am still worried it may contain a virus. How can i delete it and is it likely that it contains a virus? Tag: W32Nimda_E Tag: 41872
  - 18
    - MsmqIntCert MsmqIntCert/regsvr32/smqrt.dll HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current\Vers ion\Run\MsmqIntCert NO FURTHER INFORMATION IS AVAILABLE AT THIS TIME I have found this on my puter in a start up manager,, using google i found an amazing 11 entries, and on other engines less. what is msmqintcert, is it needed operating system, i get that it ques messages for msn msgr or is spyware, malware, but i cant get what exactly it does, or how necessary it is when i dont use msn msgr Tag: W32Nimda_E Tag: 41871
  - 19
    - Spyware Running Norton Virus Scan detecting at risk condition and a Spyware file "redirect5.exe". It recommended deletion but could not for some reason. Not sure what impact will be if I just delete the file. Any suggestions? Thanks Tag: W32Nimda_E Tag: 41870
  - 20
    - Logging on to W2K A friends office has one W2K stand alone machine. On both Thursday and Friday his secretary called to say she could not log in. Said she'd tried numerous times. Both days, by the time I got to his office, she had things working okay. She swears that the machine won't let her login until 11:10 A.M. Although I suspect operator error, I find it interesting that she has logged in 5 days a week for the last two years with no problems. Is there any known bug or virus that might manifest itself in this way? Thanks, Mac Tag: W32Nimda_E Tag: 41868
  - 21
    - works doc's can be opened by other users I may be missing something, but is there a way for me to keep other users on my computer from accessing my doc's. My account is password protected, but other users on my computer can access my doc's from the "file menu" or from the history page directly from their account. Any way of stopping this??? Thanxs Tag: W32Nimda_E Tag: 41867
  - 22
    - Unwanted Icons Every time I log on, several unwanted icons appear on my desktop (links to unwanted websites) and my "favourites" list has been updated with links I do not want. Even though I delete them they are there the next time I reboot. Can anyone suggest how to stop this? Thanks Tag: W32Nimda_E Tag: 41865
  - 23
    - OE Removed E-Mail Attachements. My email are removed and the following message is attached: "OE removed access to the following unsafe attachments in your mail:..." Where do I change the setting responsible for this? Tag: W32Nimda_E Tag: 41858
  - 24
    - e-mail from microsoft I keep getting an e-mail from "microsoft" with attachment saying use this patch immediately. The attachment is patch.exe There is no real microsoft look to the e-mail. I am wondering if it is really from them. Does anyone know? Tag: W32Nimda_E Tag: 41855
  - 25
    - a website installed an unwanted taskbar in my IE/.Yahoo browser a website, spidersearch.com, has installed itself within my IE/yahoo browser as a taskbar. When I "click" on the site it takes me to an adult site. How do I delete the taskbar? I have Windows XP Pro and a rooter that acts as a firewall. Tag: W32Nimda_E Tag: 41854
- Next
  - 1
    - Hacked System Every time I run Internet Explorer, my home page has been changed. I change it to something else each time, but everytime I put the computer on, it has been changed again. How do I fix this problem? Tag: W32Nimda_E Tag: 41848
  - 2
    - boched security i love playin games when im not usein my computer to do homework and such but my one of my parents downloaded a security update and its really got some problems they happen the most in my games saying "install directx 8.1b or later" so i install a new directx wich happens to be Directx 9 so i suspeted id pass the error with flying colors, aces high well it keeps doing that i got in touch with a tech 2 weeks ago he said sotmhing about a security update was released for XP and it had some problems that would cause problems mentioned already in my post he said deleteing it would help alot i was wondering if any of you could help me by telling me if how i can delete this it would be greatly appreciated Tag: W32Nimda_E Tag: 41837
  - 3
    - Unable to open email attachments I'm unable to open even the most inoffensive attachments to my email. This started happening after I downloaded the latest critical updates from Microsoft. Is this a coincidence, or are others having the same problem? Tag: W32Nimda_E Tag: 41835
  - 4
    - Security alert Everyday, I receive several notices from Norton Security Alert that my computer is being attacked. Right now, it is the Nimba_Propagation. Norton always blocks the incoming attacks but I would like to know how to find out who is doing this and report them. Could someone help me? Tag: W32Nimda_E Tag: 41833
  - 5
    - Internet Explorer password lost How do you reset or bypass the password protection in windows 98 internet explorer? Help Mark Tag: W32Nimda_E Tag: 41824
  - 6
    - CWS Shredder link? What was that link to get the CWS Shredder? Tag: W32Nimda_E Tag: 41823
  - 7
    - XP SP2 changes information for developer available This document focuses on the changes in Windows XP Service Pack 2 and its implications for developers. Examples and details are provided for several of the technologies that are experiencing the biggest changes. Future versions of this document will cover all new and changed technologies. http://www.microsoft.com/downloads/details.aspx?familyid=7bd948d7-b791-40b6-8364-685b84158c78 Tag: W32Nimda_E Tag: 41822
  - 8
    - password access under WINXP When I originally set up WinXP I allowed myself, my wife and my daughter to have admin privileges. Recently, for certain reasons, we decided to restrict my daughter's access to the computer. I went into user accounts, changed me to administrater and gave everyone a password. It worked for a while but then my daughter somehow bypassed the password. I am certain she did not discover the password. When I asked her how she did it, she said she went into Safe Mode and changed it back. Is this possible? Is there any way to avoid this and set up a restricted access to the computer? If not under Win XP, are there any 3rd party programs? Thanks for your help. Tag: W32Nimda_E Tag: 41816
  - 9
    - Funny - any comments? I just received this message from my IS staff person--- note that this was ust a few minutes after receiving the new 'Password Policy' below. Any comments are welcome! -- Thanks, Martin Schmid, EIT, CCSA, MCDBA, MCSE ----- Message recevied about 11:45am today The easiest way to change your password is by hitting CTRL-ALT-DEL at the same time and press the change password button. However, everyone in XYZ-2 office will have to let me know (over the phone only) what their new password is, otherwise they will not be able to access their e-mail from the XYZ mail server. So, I will be calling the XYZ-2 office this afternoon and will talk to everyone, and will change their passwords here as well. ---- Policy received about 11:30 am today. Password Policy Overview Passwords are an important aspect of computer security. They are the front line of protection for user accounts. A poorly chosen password may result in the compromise of XYZ's entire corporate network. As such, all XYZ employees (including contractors and vendors with access to XYZ systems) are responsible for taking the appropriate steps, as outlined below, to select and secure their passwords. Policy The purpose of this policy is to establish a standard for creation of strong passwords, the protection of those passwords, and the frequency of change. This policy includes all personnel who have or are responsible for an account (or any for of access that supports or requires a password) on any system that resides at any XYZ facility, has access to the XYZ network, or stores any non-public XYZ information. General · All user-level passwords must be changed every four months (you will be prompted each time your password has expired). · Passwords must not be inserted into email messages or other forms of electronic communication. · All user-level and system-level passwords must conform to the guidelines described below. Guidelines General Password Construction Guidelines Passwords are used for various purposes at XYZ. Some of the more common uses include: network/PC login, Wind2, and voicemail. Poor, weak passwords have the following characteristics: · The password contains less than six characters · The password is a word found in the dictionary (English or foreign) · The password is a common usage word such as: o Names of family, pets, friends, co-workers, fantasy characters, etc. o Computer terms and names, commands, sites, companies, hardware, software. o The words "XYZ", "Dallas", "LosAngeles", "password" or any derivation. o Birthdays and other personal information such as addresses and phone numbers. o UserID (i.e. if the login ID is "Jonathan" the password should not be "Jonathan") o Word or number patterns like aaabbb, qwerty, zyxwvuts, 123321, etc. o Any of the above spelled backwards. o Any of the above preceded or followed by a digit (e.g., password1, 1password) Strong passwords have the following characteristics: · Contain both upper and lower case characters (e.g., a-z, A-Z) · Have digits and punctuation characters as well as letters (e.g., 0-9, !@#$%^&*()_+|~-=\'{}[]:";`<>?,./ ) · Are at least eight alphanumeric characters long · Is not a word in any language, slang, dialect, jargon, etc · Are not based on personal information, names of family, etc. · Passwords should never be written down or stored on-line. Try to create passwords that can be easily remembered. One way to do this is create a password based on a song title, affirmation, or other phrase. For example, the phrase might be: "This May Be One Way to Remember" and the password could be: "TmB1w2R!" or "Tmb1W>r~" or some other variation. Also you can use special characters or numbers to replace letters in a word, for example the word is "computer" and the password could be: "C0mp*t3r" or "c*mp@ter". NOTE: Do not use any of the above examples as passwords! Password Protection Standards Do not use the same password for XYZ accounts as for other non-XYZ access (e.g. personal ISP or at home internet accounts, benefits, personal (yahoo or hotmail) e-mail accounts, etc.). Do not share XYZ passwords with anyone, including administrative assistants or secretaries. All passwords are to be treated as sensitive, confidential XYZ information. · Don't reveal a password in an email message · Don't talk about a password in front of others · Don't hint at the format of a password (e.g., "my favorite song title") · Don't reveal a password on questionnaires · Don't share a password with family members If someone demands a password, refer them to this document or have them call the IS department. Never use the "Remember My Password" feature of applications (e.g., Eudora, IM, Yahoo, etc.). This is very un-secure as it saves the password to your computer (or sometimes on the internet!) Again, do not write passwords down and store them anywhere in your office. Do not store passwords in a file on ANY computer systems (including Palm Pilots or similar devices) without encryption. Change passwords at least once every four months. If an account or password is suspected to have been compromised, report the incident to the IS department, and change all passwords. Password cracking or guessing may be performed on a periodic or random basis by the IS department. If a password is guessed or cracked during on of these scans, the user will be required to change it. Tag: W32Nimda_E Tag: 41811
  - 10
    - Kerberos error KRB_AP_ERR_TKT_NYV What is this error and how do you fix it? The kerberos client received a KRB_AP_ERR_TKT_NYV error from the server <network client>. This indicates that the ticket used against that server is not yet valid (in relationship to that server time). Contact your system administrator to make sure the client and server times are in sync, and that the KDC in realm <local domain> is in sync with the KDC in the client realm. Tag: W32Nimda_E Tag: 41804
  - 11
    - Browsing to SSL site gives Warning - cant clear it I am trying to access a website http://pay1.plugnpay.com from my web server using Internet Explorer. I get "Security Alert" the message explains: "The security Certificate was issued by a company I have not chosen to trust..." If I click "YES" I can browse the page. If I return to the page, I get same thing. If I View the certificate, and click install certificate, I get the same... it continues to ask for this. I have reinstalled Internet Explorer, tinkered with the security settings (to set them to lowest settings), asked IE not to warn me on bad certificates, etc... nothing seems to work. How can I get this message to go away, by either installing the client end of the certificate or some other means? I normally would not care, because I dont browse from the server, but I have a DLL on the server which is trying to access this site and generating an error message (pnpcom_err = HttpSendRequest failed: 12045) which I think is related. By the way I can visit this site from other systems and never got this message. The server I am browsing from is running NT40 with latest patches, and I am using IE6SP1 with patches. Tag: W32Nimda_E Tag: 41803
  - 12
    - virus problem? I am unable to access certain specific web pages and get the error message explorer has encountered a problem and must shut down, do you want to send a report. I have Mcafee antivirus installed and I also used trendmicro housecall to remove some viruses. These antivirus programs now say I am clean but I am still having these problems. I can access these pages from a different computer. How can I tell if this is a virus and how do I remove it? Tag: W32Nimda_E Tag: 41802
  - 13
    - What security holes do I open up if I temp map a drive to a remote computer. I was asked the other day if I temporarily map a drive to a remote server if it will open a hole back into my network. What specific security concerns are there with such and action? Tag: W32Nimda_E Tag: 41801
  - 14
    - ** READ THIS BEFORE POSTING - answers to frequently asked questions 2003.12.12 Before you post a question to a Microsoft.public.*.security newsgroup, note that your question may already be answered below: Answers to Top Frequently Asked Questions: http://securityadmin.info My question is not mentioned below. How do I get an answer immediately, with no waiting? http://securityadmin.info/faq.htm#moreinfo See also: http://www.google.com/groups?as_ugroup=microsoft.public.* See also: http://www.google.com/advanced_group_search See also: http://www.google.com I want to post a problem or question to the newsgroup. What info do I need to post in order to get a correct answer quickly? http://securityadmin.info/faq.htm#netiquette I just heard about a new Microsoft security patch update. Where can I get the patch? http://windowsupdate.microsoft.com OR http://www.microsoft.com/technet/security/current.asp I just installed a Microsoft security patch update, and now my computer is having problems. http://securityadmin.info/faq.htm#patchbroke I received an email from Microsoft / Microsoft Support / Microsoft Internet Security Center claiming to be a security patch [or comprehensive Internet Explorer update]. Is this a virus? http://securityadmin.info/faq.htm#microsoftemail ALSO NOTE: www.grisoft.com is free antivirus, USE IT. I received a virus email from a Microsoft email address. Who do I report this to? http://securityadmin.info/faq.htm#microsoftemail I have the RPC Blaster worm "virus," what do I do? http://www.microsoft.com/security/incident/blast.asp ALSO NOTE: www.grisoft.com is free antivirus, USE IT. My computer is giving RPC Remote Procedure Call messages. There is a TFTP message or file on my computer. My computer keeps locking up, and/or rebooting, or telling me that it will reboot in 1 minute. http://www.microsoft.com/security/incident/blast.asp ALSO NOTE: www.grisoft.com is free antivirus, USE IT. Where can I download the Blaster worm / RPC DCOM patch? http://windowsupdate.microsoft.com OR http://www.microsoft.com/technet/security/current.asp I'm having a problem caused by the JDBGMGR.EXE Teddy Bear "virus" hoax, or I want to replace this file. http://securityadmin.info/faq.htm#jdbgmgr I forgot my Windows logon password and can't log in. How do I reset it? http://securityadmin.info/faq.htm#password I have a problem or a question with a virus or with antivirus. http://securityadmin.info/faq.htm#virus NOTE: www.grisoft.com is free antivirus, USE IT. Why is Outlook Express blocking my attachments as "unsafe"? http://securityadmin.info/faq.htm#attachments How do I stop getting pop-up messages? Or adware? Or spyware? http://securityadmin.info/faq.htm#pop-ups How do I block people from viewing adult or objectionable content on a computer? http://securityadmin.info/faq.htm#contentfilter How do I block spam emails? http://securityadmin.info/faq.htm#spam There is a Content Advisor password blocking me from certain web sites. http://securityadmin.info/faq.htm#contentadvisor How do I delete an FTP folder that a hacker put on my computer and I cannot delete? http://securityadmin.info/faq.htm#ftpfolder Have I been hacked? What do I do if I've been hacked? http://securityadmin.info/faq.htm#hacked How do I re-secure a computer that has been hacked? http://securityadmin.info/faq.htm#re-secure How do I test or improve the security on my computer to avoid being hacked? http://securityadmin.info/faq.htm#harden How do I investigate a suspicious IP address that may be trying to hack me? http://securityadmin.info/faq.htm#trace How do I report a hacker? http://securityadmin.info/faq.htm#reporthacker How do I use a port scanner or vulnerability scanner to test my security? http://securityadmin.info/faq.htm#portscanner How do I encrypt my files and/or hard drive? http://securityadmin.info/faq.htm#encryption How do I get a firewall? IDS? http://securityadmin.info/faq.htm#firewall I want to use the IPSec filtering or IP filtering feature of Windows to block certain ports and have a problem or question. http://securityadmin.info/faq.htm#ipsec I have a problem or question with the XP ICF firewall. http://securityadmin.info/faq.htm#icf I have a problem or question with the IIS URLScan tool. http://securityadmin.info/faq.htm#urlscan How do I change the banner on my computer or server to hide what software version I'm using? http://securityadmin.info/faq.htm#banner How do I enable Windows Auditing to tell who logged into Windows or who accessed a file? http://securityadmin.info/faq.htm#auditing How do I inspect and disable programs that start up when Windows starts? http://securityadmin.info/faq.htm#startup How do I use RUNAS or let someone use RUNAS to run commands as administrator without having to type the password? http://securityadmin.info/faq.htm#runas How do I let non-administrator users run Defrag or change their IP address? http://securityadmin.info/faq.htm#runas My question is not mentioned above. How do I get an answer immediately, with no waiting? http://securityadmin.info/faq.htm#moreinfo See also: http://www.google.com/groups?as_ugroup=microsoft.public.* See also: http://www.google.com/advanced_group_search See also: http://www.google.com I want to post a problem or question to the newsgroup. What info do I need to post in order to get a correct answer quickly? http://securityadmin.info/faq.htm#netiquette Note that this is NOT a full list of all the questions answered in the FAQ. Chances are, your question has probably already been answered. The complete FAQ is at: http://securityadmin.info/faq.htm#contents I hope this is helpful. Feedback, suggestions and criticism regarding the FAQ are welcome and may be emailed to me. kind regards, Karl Levinson, CISSP, MCSE, MVP email: levinson_k@despammed.com Tag: W32Nimda_E Tag: 41795
  - 15
    - Is it possible to secure private objects with hierarchical relationship with taking hierarchy into account? Hi, everybody I have some private objects which I would like to secure. These objects have some hierarchical relationship similar to those found in the file system and registry. Is it possible to use standard mechanisms for inheriting access rights from parent object, propagation etc. in case of private objects? If yes, where can I possibly find some examples of proper way of doing this kind of things? Thanks in advance, Antonio Tag: W32Nimda_E Tag: 41793
  - 16
    - Windows Server 2003 Terminal Server FIPS 140-1 Compatible Encryption Can anyone explain in plain English what the difference is between using 128-bit (High) encryption and FIPS 140-1 compliant encryption for Windows Server 2003 Terminal Server connections other than government regulation comliance? I have read that FIPS defines a security module standard, but nowhere can I find exactly HOW encrypted a FIPS compliant RDP connection IS (how many bits?) compared to a 128-bit encrypted connection. Any help would be greatly appreciated. Tag: W32Nimda_E Tag: 41792
  - 17
    - Passthrough Authentication I need to know whether anybody else thinks this is a problem - specifically in the following context.. You have a non-domain member XP workstation, logged on locally with local account username 'whatever', password 'whatever'. On the same network there is a Domain, with a share restricted to 'Domain Users'. On the Domain, there is a user called 'whatever', password 'whatever'. From the XP box, connect to the domain share. You will be connected - as the domain user, without prompting -passthrough authentication. Not a problem (so I'm told by Microsoft - by design). Try changing one of the passwords so they don't match..XP will retry the authentication 10 times (some places say 12, I've only ever seen 10). Assuming your domain has account lockout rules, the domain account will become locked out. Even though you are not trying to connect using a domain account, and you have not been challenged for a username and password yet! When XP has finished retrying the username/password combination, it will offer a password challenge - too late - the account (on the Domain) is already locked out. I'm really concerned by this, and can not see its justification in todays world. It appears to be a case of failing insecure, rather than failing safe. Why not just challenge all authentication requests from untrusted sources? Can anybody elighten me? Tag: W32Nimda_E Tag: 41790
  - 18
    - unable to open attachments in email 99% of the attachments sent in my email are removed and the following message is attached: "OE removed access to the following unsafe attachments in your mail:..." Where do I change the setting responsible for this? Tag: W32Nimda_E Tag: 41779
  - 19
    - Pages opening to a blank white page I am using Win XP, Internet Exp. I am trying to open http://forums.attwireless.com/attws and all it does is goes to a blank white page with the status saying "Done". I have looked at my security levels, my pop-up blocking, cookies, and I can not figure out what the problem is. Can anyone offer me a direction. This is driving me nuts. Tag: W32Nimda_E Tag: 41777
  - 20
    - Need Advice On "Mystery" Programs Okay, I recently noticed some new programs in the Add/Remove Programs List. They weren't there before I downloaded Kazaa to my computer, and they remained there even after I'd deleted all Kazaa componets. The program names are: Batch Assistence, Data Compiler, Indexing Function, SBM OS, Search OS, TP HTTP, and URL.IE APP. Some of these have popped up recently (after the removal of Kazaa) and since I don't know much about computers I'm afraid they might be viruses that my virus scan isn't picking up...I'm using Windows ME. Please if anyone has any idea whatsoever about any of these programs, or how to remove them (or if I even should remove them) please email me at: melissa_d_irby@yahoo.com I would really appreciate it! Tag: W32Nimda_E Tag: 41772
  - 21
    - URL-Spoofing vulnerability This article came across my desk today: http://www.informationweek.com/story/showArticle.jhtml?articleID=16700218 In it, it says: "Microsoft said it's investigating the flaw and that it's not aware of any affected customers or hacking tools that are available to take advantage of the flaw. In its statement, Microsoft said it would consider issuing a patch if needed." -- ?!! Scammers are phishing using this exact technique for MONTHS now. I have received tons of phishing spam e-mails dating back several months. "...not aware of hacking tools that are available take advantage of the flaw..."? How about Notepad for crying out loud!!! There also seems to be at least two different ways to format the URL string to make this vulnerability work. These tests use two different methods. http://www.secunia.com/internet_explorer_address_bar_spoofing_test http://www.zapthedingbat.com/security/ex01/vun1.htm MS should issue a patch to this problem immediately instead of waiting for another month... Tag: W32Nimda_E Tag: 41769
  - 22
    - Windows ME login bypass How can I stop the cancel button from bypassing the login requirement and loading into windows? Tag: W32Nimda_E Tag: 41767
  - 23
    - Office XP I won a package of Office XP at one of Microsoft shows. The package seems to indicate you must have internet access to load the program. Is there any way to load the program without having internet acccess???? Tag: W32Nimda_E Tag: 41764
  - 24
    - Windows Security monitoring. I am a database administrator that has been asked to find out if there is a product or products that we can use to monitor all 200+ servers as well as our internet/intranet for intrusion. I asked to find the cheeapest and easiest means of monitoring. Are there Microsoft tools for this, or do I need to look elsewere? They would like use to keep an eye on web logs, server event logs ect. Any help would be great. Tag: W32Nimda_E Tag: 41757
  - 25
    - Digitally signing email in Outlook Hello, I recently came across a security puzzle dealing with email signing certs in Outlook: I just sent my buddy an email signed with my new email signing certificate. However when he opened it, he gets the error messages: "The system cannot validate the certificate used to create this signature because the issuer's certificate is either unavailable or invalid. The system cannot determine whether the certificate used to create this signature is trusted or not." I told him that he needed to trusted the root CA which I promptly sent him, as an attachment in a separate email. But the question remains: Why doesn't Outlook automatically (or give you the option) to send the certificate chain along with your email signing cert? That way, recipients would be able to trust the issuer certificate if they so choose! I investigated the MS Knowledge Base, and came up with article # 278207 at URL: http://support.microsoft.com/default.aspx?scid=kb;en- us;278207. The puzzling thing is that this article talks about enabling CRLs, which seems way off the mark! Thoughts anybody? -- POCO Tag: W32Nimda_E Tag: 41755

I have a computer that has been infected by the W32Nimda_E
virus. The most obvious effect is to make IE6 run
extremely slow. I downloaded FxNimdaE.com from Norton,
but it can't get rid of it. Anybody got any suggestions.

Top

Re: W32Nimda_E by xp

xp
Mon Dec 15 10:31:45 CST 2003

"Stinger.exe" from Network Associates may clean it. It's small enough to
fit on a floppy and lists nimda as one of the viruses it cleans. Here's the
link:

http://vil.nai.com/vil/stinger/

Good luck!

"cwb" <anonymous@discussions.microsoft.com> wrote in message
news:007701c3c31f$eaafad10$a101280a@phx.gbl...
> I have a computer that has been infected by the W32Nimda_E
> virus. The most obvious effect is to make IE6 run
> extremely slow. I downloaded FxNimdaE.com from Norton,
> but it can't get rid of it. Anybody got any suggestions.
>
>

Top